Add init container to the gateway to wait for node readiness #3273
Conversation
|
🤖 Created branch: z_pr3273/tpantelis/gw_init_container |
d17fff3 to
932eda6
Compare
See submariner-io/submariner#3222 Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
16593ea to
f46ddb6
Compare
| @@ -110,7 +110,6 @@ func newRouteAgentDaemonSet(cr *v1alpha1.Submariner, name string) *appsv1.Daemon | |||
| Name: name + "-init", | |||
| Image: getImagePath(cr, opnames.RouteAgentImage, names.RouteAgentComponent), | |||
| ImagePullPolicy: images.GetPullPolicy(cr.Spec.Version, cr.Spec.ImageOverrides[names.RouteAgentComponent]), | |||
| Command: []string{"submariner-route-agent.sh"}, | |||
There was a problem hiding this comment.
This removal is harmless, but was it intended as part of this PR?
There was a problem hiding this comment.
It's cleanup that was missed before but technically should be in another PR. I'll remove it.
| Privileged: ptr.To(true), | ||
| RunAsNonRoot: ptr.To(false), | ||
| // We need to be able to update /var/lib/alternatives (for iptables) | ||
| ReadOnlyRootFilesystem: ptr.To(false), |
There was a problem hiding this comment.
This shouldn’t be necessary in the init container.
| AllowPrivilegeEscalation: ptr.To(true), | ||
| Privileged: ptr.To(true), |
There was a problem hiding this comment.
Given how the gateway container image is set up currently, this is necessary in all cases (since the entrypoint script writes to /proc/sys), but ideally the init container shouldn’t need these.
I agree - it's not ideal for the init container. As you surmised, I added it b/c the entry script failed here:
Perhaps all we need is Longer term, we could add a “wait for node readiness” binary to the image as you suggest and specify that for the init container command. |
|
🤖 Closed branches: [z_pr3273/tpantelis/gw_init_container] |
See submariner-io/submariner#3222